How a ChatGPT for Mac Flaw Could Expose Chats and Connected Apps

Objective-See researchers found that ChatGPT for macOS could mistake commands carried by an untrusted script for requests from a trusted app component. An attacker first needed to run code on the victim’s Mac, but did not need elevated privileges; exploiting the flaw could let that code take over the ChatGPT app and access data available to it. 247

How the trusted-interpreter bypass worked

ChatGPT’s macOS app used process and code-signature checks to distinguish trusted components from untrusted code. The flaw was that an attacker could use a trusted script interpreter to pass an untrusted script into the app. In effect, the checks trusted the interpreter without adequately establishing that the script and the commands it delivered were trustworthy. 45

This was a local attack: malicious code had to be running on the same Mac first. The reports describe the needed code as unprivileged, so the attacker did not have to begin with administrator or root access. 78

What an exploit could access

Once the attacker’s commands were accepted as coming from a trusted ChatGPT component, they could potentially read saved conversations and issue commands through the app. The reported impact also included data or services available through ChatGPT integrations, such as browser sessions. 247

That does not mean the flaw gave an attacker unrestricted control of the entire Mac. The described access was through the compromised app and the data and integrations available to it. 27

OpenAI’s fix

OpenAI’s macOS changelog listed a fix for CVE-2026-100754 on September 25, 2026, in ChatGPT version 26.924.20706. Reports about the issue appeared publicly on October 2. Users of the Mac app should install the fixed version or a later release. 247

Why the finding matters for AI assistants

The vulnerability highlights that an AI app can be a valuable target not only because of what it generates, but also because of what it can access and do. Chat histories and connected services can make a compromised assistant a route to sensitive information. 2

The broader security lesson is about trust boundaries: verifying that a process is signed or trusted is not enough if that process can carry untrusted instructions into an application. Objective-See has described its continuing work as research into AI-agent security, underscoring the need to examine how assistants validate the origin of commands as their capabilities and integrations expand. 14